# stupid newbie question

Seth I. Rich (sir@po.cwru.edu)
Fri, 9 Feb 1996 07:31:44 PST

- Messages sorted by:[ date ][ thread ][ subject ][ author ]

    > OK, first message. I'm setting up a MOO. One member
    > of the CS dept is in strong opposition... very strong...
    > what can I do to
    >
    > politically: quiet her fears
    >
    > Technically: make the MOO secure
    >
    > she's worried about breakins... and says MOOs are notorious
    > among sysops as security nightmares. After months of work
    > on my part to get the server acquired and running, she wants
    > it shut down and banned.

    1. DO NOT RUN FUP.  (Here I want to say, up-front, that this is a
       POLITICAL suggestion, not a TECHNICAL one.)  It is very valuable to
    be able to claim to your sysadmin that the MOO allows no (zero) access
    to the filesystem (except when checkpointing) and allows no (zero) access
    to the shell.  FUP shaves a little bit off that claim, but it's enough
    little bit that you can't afford it at this time.

    2. If you're going to be running with open_network_connection() enabled,
       get your wizards to sign an agreement that they will not use that
    ability to do anything inappropriate.  (Spell it out.)

    3. Research any security issues involved with firewalls at your site.
       Offer to work with your sysadmin to make those problems go away.

    4. Offer to run the MOO only during off-peak hours.  Offer to limit the
       disk space used by the MOO data.  Offer to limit the size of the
    server's process (rebooting when it's too large).  Offer to limit
    the number of active connections at any one time.  Make concessions.

    5. Running a MOO -will- get your server machine more failed login
       attempts than they're used to.  People -will- telnet to the MOO's
    machine and attempt to log on as their MOO characters.  This in itself
    does not pose a threat.  Make them understand, tactfully, that security
    issues on the machine are -their- responsibility.  If they have any such
    holes, it's possible that the only reason they haven't been exploited is
    that nobody's tried their machine before.  Advertising the address may
    attract people to the site, which in turn may result in those holes being
    exploited.  It's not the MOO's fault; it's the sysadmin's fault.  Be as
    tactful about this as possible, but make them understand.

    Seth / Blackbriar

    --
    ----------------------------------------------------------------------
    Seth I. Rich
    Woo, woo!  OpalMOO's back!       There is nothing more precious than
    Rabbits on walls, no problem.    a tear of true repentance.